Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip

Overview

General Information

Sample URL:http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip
Analysis ID:1540591
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Usage Of Web Request Commands And Cmdlets
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

  • System is w10x64
  • cmd.exe (PID: 4724 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip" > cmdline.out 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
    • conhost.exe (PID: 5972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • wget.exe (PID: 6584 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)
  • cleanup
No configs have been found
No yara matches
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5436, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip" > cmdline.out 2>&1, ProcessId: 4724, ProcessName: cmd.exe
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownDNS traffic detected: query: assets.localytics.com replaycode: Name error (3)
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: assets.localytics.com
Source: wget.exe, 00000002.00000002.2016071791.0000000000B97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e955
Source: wget.exe, 00000002.00000002.2015880634.0000000000100000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.drString found in binary or memory: http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/24
Source: classification engineClassification label: clean2.win@4/1@1/0
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Desktop\cmdline.outJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5972:120:WilError_03
Source: C:\Windows\SysWOW64\wget.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: wget.exe, 00000002.00000002.2016071791.0000000000B97000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-bottom_third_icon_one_button_updated__2_.zip" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-bottom_third_icon_one_button_updated__2_.zip"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-bottom_third_icon_one_button_updated__2_.zip" Jump to behavior
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Command and Scripting Interpreter
1
DLL Side-Loading
1
Process Injection
1
Masquerading
OS Credential Dumping1
Security Software Discovery
Remote ServicesData from Local System1
Non-Application Layer Protocol
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading
1
Process Injection
LSASS Memory1
System Information Discovery
Remote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading
Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1540591 URL: http://assets.localytics.co... Startdate: 23/10/2024 Architecture: WINDOWS Score: 2 12 assets.localytics.com 2->12 6 cmd.exe 2 2->6         started        process3 process4 8 conhost.exe 6->8         started        10 wget.exe 1 6->10         started       
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
assets.localytics.com
unknown
unknownfalse
    unknown
    NameSourceMaliciousAntivirus DetectionReputation
    http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/24wget.exe, 00000002.00000002.2015880634.0000000000100000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.drfalse
      unknown
      http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e955wget.exe, 00000002.00000002.2016071791.0000000000B97000.00000004.00000020.00020000.00000000.sdmpfalse
        unknown
        No contacted IP infos
        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1540591
        Start date and time:2024-10-23 23:53:19 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 1m 33s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:urldownload.jbs
        Sample URL:http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:4
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Detection:CLEAN
        Classification:clean2.win@4/1@1/0
        EGA Information:Failed
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 0
        • Number of non-executed functions: 0
        Cookbook Comments:
        • Unable to download file
        • Exclude process from analysis (whitelisted): dllhost.exe
        • Not all processes where analyzed, report is missing behavior information
        • VT rate limit hit for: http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip
        No simulations
        No context
        No context
        No context
        No context
        No context
        Process:C:\Windows\SysWOW64\cmd.exe
        File Type:ASCII text, with CRLF line terminators
        Category:modified
        Size (bytes):338
        Entropy (8bit):5.144958983001971
        Encrypted:false
        SSDEEP:6:HR7kxXDi9NTXLGeTfriAd1hIpHVJ89NDEWWA2NmDEcpGmsdXAaRINHv:HRoxXDU9bGZAd1hIpn89KRA2Q5a25v
        MD5:9975AEAA910B5B720801AD0FE6F9171D
        SHA1:4634A7EAD61880652021DEAE63C626AB1AA39032
        SHA-256:9A465FF07788A082FA763EE61F00B3A3E3315755B0A924456B4E837E9D8648C4
        SHA-512:F9442C604815CC326D9944FF6D46D6BBC9524BACFB80146749C8913C7FD33EFDB1EBDAEAA2AE87186510D06D1A01BE691517EBC46FF3108A51DD42E3410CEC75
        Malicious:false
        Reputation:low
        Preview:--2024-10-23 17:54:08-- http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip..Resolving assets.localytics.com (assets.localytics.com)... failed: No such host is known. ...wget: unable to resolve host address 'assets.localytics.com'..
        No static file info
        TimestampSource PortDest PortSource IPDest IP
        Oct 23, 2024 23:54:09.100033045 CEST6124053192.168.2.51.1.1.1
        Oct 23, 2024 23:54:09.115449905 CEST53612401.1.1.1192.168.2.5
        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
        Oct 23, 2024 23:54:09.100033045 CEST192.168.2.51.1.1.10x121cStandard query (0)assets.localytics.comA (IP address)IN (0x0001)false
        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
        Oct 23, 2024 23:54:09.115449905 CEST1.1.1.1192.168.2.50x121cName error (3)assets.localytics.comnonenoneA (IP address)IN (0x0001)false

        Click to jump to process

        Click to jump to process

        Click to jump to process

        Target ID:0
        Start time:17:54:07
        Start date:23/10/2024
        Path:C:\Windows\SysWOW64\cmd.exe
        Wow64 process (32bit):true
        Commandline:C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip" > cmdline.out 2>&1
        Imagebase:0x790000
        File size:236'544 bytes
        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:true

        Target ID:1
        Start time:17:54:07
        Start date:23/10/2024
        Path:C:\Windows\System32\conhost.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Imagebase:0x7ff6d64d0000
        File size:862'208 bytes
        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:true

        Target ID:2
        Start time:17:54:08
        Start date:23/10/2024
        Path:C:\Windows\SysWOW64\wget.exe
        Wow64 process (32bit):true
        Commandline:wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://assets.localytics.com/amp/customer_upload/ee9c12e9b59bfdc6191f0f183e9554f70db56883/1606877/2420136/phone-Bottom_Third_Icon_One_Button_updated__2_.zip"
        Imagebase:0x400000
        File size:3'895'184 bytes
        MD5 hash:3DADB6E2ECE9C4B3E1E322E617658B60
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:true

        No disassembly